Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 22:11:33 +0000 CVE-2026-109382 — WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_p… https://db.gcve.eu/vuln/cve-2026-109382 <p><strong>Affected:</strong> bilalnaseer WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT &amp; AI Agents</p> <p>The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint&#39;s authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over &#39;publish&#39;, &#39;draft&#39;, &#39;pending&#39; and &#39;future&#39; posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.</p> <p><strong>Affected:</strong> bilalnaseer WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT &amp; AI Agents</p> <p>The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint&#39;s authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over &#39;publish&#39;, &#39;draft&#39;, &#39;pending&#39; and &#39;future&#39; posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.</p> https://db.gcve.eu/vuln/cve-2026-109382